Github.com/juju/juju
10 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Github.com/juju/juju, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Github.com/juju/juju CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 3 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 3 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High4
- Medium3
Latest CVEs
The 10 most recently published vulnerabilities affecting Github.com/juju/juju.
- CVE-2026-1237Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that i...—
- CVE-2025-0928Arbitrary executable upload via authenticated endpoint8.8
- CVE-2025-53513Zip slip vulnerability in Juju8.8
- CVE-2025-53512Sensitive log retrieval in Juju6.5
- CVE-2023-0092An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.4.9
- CVE-2024-8038Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This ...7.9
- CVE-2024-8037Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the ...6.5
- CVE-2024-7558JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to...8.7
- GHSA-6vjm-54vp-mxhxJuju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm—
- CVE-2017-9232Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.9.8
Product grouping is registry-driven, with AI assist and human review. How it works